Hardware wallet manufacturer Ledger has launched an urgent investigation into a suspected $86 million crypto theft that appears to stem from tampered devices sold by a third-party reseller. The company acknowledged reports on Friday from users who saw their wallets drained of assets across the Bitcoin, Ethereum, and Tron networks after purchasing devices from CryptoBilis, a reseller in Southeast Asia. These Ledger probes are ongoing.
The incident has sparked alarm among cryptocurrency holders who rely on hardware wallets for offline asset protection. While Ledger has not independently confirmed the $86 million loss figure, it has taken immediate precautionary steps, asking CryptoBilis to halt all sales and shipments. The company is advising recent customers of the reseller to take protective measures, sending a shockwave through the digital asset community.
Ledger probes into reseller devices prompt urgent warning
In a series of public statements, Ledger Support moved quickly to contain the potential fallout from the reported thefts. The company’s primary message has been to isolate the problem to a single reseller channel, reassuring the market that there is no evidence of a compromise within Ledger’s own core systems or its hardware’s underlying security technology. This distinction is critical for the brand.
Ledger has issued specific guidance for customers who may be affected. Those who purchased a device from CryptoBilis within the last 90 days and have not yet set it up are being warned not to do so.
For users who have already activated a device from this reseller, the company recommends a more drastic step: immediately transferring all crypto assets to a secure alternative, preferably a new Ledger device with a freshly generated recovery phrase.
This advice underscores the potential severity of the vulnerability. If devices were indeed compromised before they reached customers, any funds moved to those wallets would be at immediate risk.
The focus on a “newly generated recovery phrase” is paramount, as it suggests the original seed phrases supplied with the tampered devices are likely known to the attackers. The incident highlights the complex challenges companies face when trying to navigate diverse regulations and maintain quality control across a global network of independent distributors.
CryptoBilis, the reseller at the center of the controversy, has been instructed to pause its operations pending the outcome of the investigation. The situation serves as a stark reminder of the potential weak points in the global distribution network for security-critical products.
While buying from authorized resellers is common practice, this incident may push more security-conscious users to purchase hardware directly from manufacturers to minimize risk.
Anatomy of a suspected supply chain attack
While the investigation is ongoing, security experts and on-chain analysts believe the thefts bear the hallmarks of a sophisticated supply chain attack. This type of exploit doesn’t target a company’s software but rather intercepts physical products after they leave the factory and before they reach the end consumer. It represents a different, more physical threat vector compared to purely digital AI attacks on crypto infrastructure.
In this scenario, malicious actors would have obtained genuine Ledger devices, tampered with them, and then introduced them back into the supply chain through a reseller. The most likely method involves the attacker generating a recovery seed phrase, saving it, and then packaging the device with that pre-determined phrase.
The unsuspecting user would receive what looks like a new, sealed device and initialize it using the compromised phrase, assuming it to be random and secure.
Once the user transfers significant assets to the wallet, the attacker, who holds the master key, can simply drain the funds to addresses under their control. This method is pernicious because it bypasses the hardware wallet’s core security features. The device itself may be functioning perfectly, but because the user’s foundational secret—the seed phrase—was never secret to begin with, the security is rendered useless.
Binance founder Changpeng “CZ” Zhao commented on the situation, stating that a “single-vendor supply-chain attack” was the most likely explanation based on the available information. He suggested that a limited number of users probably bought fake or tampered devices.
This assessment, while not a confirmed finding from Ledger, aligns with the theory that the breach is contained to a specific batch of products from one reseller and not a systemic flaw in Ledger’s hardware.
On-chain investigation reveals multi-network theft
The scale of the heist first came to light through the work of pseudonymous on-chain investigator Specter, who began tracking suspicious outflows after seeing user reports on social media platforms X and Reddit. Specter traced funds being siphoned from hundreds of wallets across multiple blockchains, painting a picture of a widespread and coordinated criminal operation.
The multi-chain nature of the attack shows how thieves target a variety of assets, not just those on a single network.
According to initial reports citing Arkham data, the stolen funds include nearly $30 million in Ethereum (ETH) and 211 Bitcoin (BTC), worth approximately $17.55 million at current prices. Victims also reported significant losses of stablecoins, including USDD and USDT, on the TRON network. The total unconfirmed estimate remains around $86 million, which would make it one of the largest crypto security incidents of the year.
On-chain data shows the attackers moving the stolen funds through a series of wallets in an attempt to obscure their origin and cash out. Unchained, another crypto media outlet, reported that Specter had identified 10 attacker addresses holding over $25 million, though much of the capital was already on the move. Tracking these funds is a complex, ongoing effort involving multiple security firms and investigators.
In response to the theft, the Security Alliance, an organization dedicated to crypto security, has put out a call for victims. The group asked anyone whose funds were drained to the identified attacker addresses to contact them via the “SEAL 911” Telegram bot.
This effort aims to centralize information from victims, assist law enforcement, and coordinate a broader industry response to track and potentially recover the stolen assets.
A blow to hardware wallet confidence?
The incident strikes at the heart of the crypto self-custody ethos. Hardware wallets are widely considered the most secure way for individuals to manage their own digital assets, a principle also driving entities like Bitcoin corporate balance sheets.
By keeping private keys offline, they are designed to be immune to the online hacks and exchange collapses that have plagued the industry. A supply chain attack, however, exploits the trust placed in the physical delivery of that security.
For Ledger, this is a significant reputational challenge, even if its own technology is not at fault. The company has built its brand on being a bastion of security for retail and institutional investors alike. Any incident that associates its name with an eight-figure theft risks eroding that hard-won trust.
It raises difficult questions about the company’s oversight of its authorized reseller program and the guarantees it can provide for products not sold directly.
This event will undoubtedly force a change in user behavior and industry best practices. Security experts have long advised purchasing hardware wallets directly from the manufacturer to eliminate the risk of third-party tampering. This incident serves as a costly, real-world lesson in why that advice matters.
Users will likely become more vigilant about checking device packaging for any signs of tampering and may demand more robust verification methods from manufacturers.
Ultimately, the attack is a sobering reminder that security is a multi-layered process. While a hardware wallet provides robust technological protection, that protection is only as strong as the integrity of the supply chain that delivers it and the operational security of the user who sets it up.
As the investigation unfolds, the entire crypto ecosystem will be watching closely for lessons that can be learned to prevent such a devastating breach from happening again.